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1 . (Currently Amended) A method comprising a plurality of activities, comprising: 
automatically: 

receiving a plurality of elements for each of a plurality of continuous data streams; 
treating the plurality of elements as a first data stream matrix that defines a first 
dimensionality; 

reducing the first dimensionality of the first data stream matrix to obtain a second 
data stream matrix, the sepond data stream matrix comprising a plurality of sampled 
values of the first data stream matrix ; 

randomly computing a singular value decomposition of the second data stream 
matri x, _a probability of computation determinable based upon a ratio of a magnitude of a 
sum of sampled values obtained since a prior computation of the singular value 
depqmpositjcw tQ 3 q^cu^ed product qf a determfred separating value qf eigenvalues 
a nd a dete rmined ei genvalue o f the second data stream matrix; and 

based on the singular value decomposition of the second data stream matrix, 
quantifying approximate linear correlations between the plurality of element s, the 
approximat e linear correlations b etween the pluralit y of elements usable to automatically 
identify and ^utpm^jcaHy report a denial of service mwk without address gpqofing, 

2. (Currently Amended) The method of claim 1 , further comprising: 

obtaining the plurality of element s, the plurality of elements stored as a collection of hash 
junctions. 

3. (Original) The method of claim 1 , wherein at least one of the plurality of continuous data 
streams is synchronous. 

4. (Original) The method of claim 1 , wherein at least one of the plurality of continuous data 
streams is asynchronous. 
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5. (Original) The method of claim 1 , wherein at least one of the plurality of continuous data 
streams is bursty. 

6. (Original) The method of claim 1 , wherein at least one of the plurality of continuous data 
streams is sparse. 

7. (Original) The method of claim 1 , wherein at least one of the plurality of continuous data 
streams comprises out of order elements. 

8. (Currently Amended) The method of claim 1 5 wherein said reducing activity app lies th e 
Jeh& son - Lind e nstraus s L e mm a obtains values for the second data stream matrix from a 
Gaussian disfributipn and preserves relative .distan.cesbetw^n vectors in aresulting 
space of the_second data stream, matrix as compared, to the first dat^^ stream matrix^ the 
gepQjid rqatrix . det e rmmod via a sliding window gtream model . 

9. (Currently Amended) The method of claim 1 , further comprising: 

repeating said computing activity, said computing activity repeated responsive to a 
change in the second data stream matrix caused by additional data sampled from a data 
Streatq pf foe plurality qf contiguous data steams. 

10. (Currently Amended) The method of claim 1, further comprising: 

responsive to an expiration of some entries in the second data stream matrix, p eriodically 
repeating said computing activity. 

1 1. (Original) The method of claim 1, further comprising: 
randomly repeating said computing activity. 

12. (Currently Amended) The method of claim 1, wherein said quantifying activity occurs 
d y namic ally responsi ve to sliding window stream th at vari es oyer time . 
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1 3. (Original) The method of claim 1, wherein the approximate linear correlations comprise a 
plurality of eigenvalues that approximate principal eigenvalues of the first data stream 
matrix. 

14. (Original) The method of claim 1, wherein the approximate linear correlations comprise a 
plurality of eigenvectors that approximate principal eigenvectors of the first data stream 
matrix. 

15. (Original) The method of claim 1, further comprising: 

receiving a user-specified accuracy metric for the approximate linear correlations. 

16. (Original) The method of claim 1, wherein the approximate linear correlations meet a 
user-specified accuracy metric. 

1 7. (Currently Amended) The method of claim 1, further comprising: 
outp^tta g- o ut put ting the approximate linear correlations. 

1 8. (Original) The method of claim 1 , further comprising: 
reporting the approximate linear correlations. 

19. (Currently Amended) A machine-readable medium comprising instructions for activities 
comprising: 

receiving a plurality of elements for each of a plurality of continuous data streams; 
representing the plurality of elements as a first data stream matrix that defines a first 
dimensionality; 

automatically reducing the first dimensionality of the first data stream matrix to obtain a 
second data stream matri x, the second data stream matrix comprising a plurality of sampled 
values of the first data stream matrix; 

randomly computing a singular value decomposition of the second data stream matrix^a 
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value of the plurality of sampled values to a calculated product of a determined separating 
vay^aeja£ejg^ stre am matrix: and 

based on the singular value decomposition of the second data stream matrix, quantifying 
approximate linear correlations between the plurality of elements, \\)$ approxim ate linear 
correlations between the p lurality of elements usable to automatically identify and 
automatically report a denial of service attack without address spoofing . 

20. (Currentiy Amended) A system comprising: 

a stream element processor adapted to receive a plurality of elements for each of a 
plurality of continuous data streams; 

a first matrix processor adapted to represent the plurality of elements as a first data 
stream matrix that defines a first dimensionality; 

a second matrix processor adapted to: 

reduce the first dimensionality of the first data stream matrix to obtain a second data 

stream matrix; 

randomly, compute a singular value decomposition of the second data stream matrix^ 
probability of computation determinable based upon a ratio of a magnitude of a sampled 
vaj^e of th^lur^i^o of a determi^jl^Earating 

value of eigenvalues and a determined eigenvalue of the second data stream matrix : and 

based on the singular value decomposition of the second data stream matrix, quantify 
approximate linear correlations between the plurality of elements, t he approximate linear 
correlations between the plurality of elements usable to automatically identify and 
automatically report a denial of service attack without address spoofing . 
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